[PATCH v4] wifi: ath6kl: fix OOB access from firmware ADDBA window size

[PATCH v4] wifi: ath6kl: fix OOB access from firmware ADDBA window size

[Tristan Madani]

aggr_recv_addba_req_evt() logs a debug message when the firmware-supplied
win_sz is outside [AGGR_WIN_SZ_MIN, AGGR_WIN_SZ_MAX] but does not
return. The out-of-range win_sz is then used in TID_WINDOW_SZ() to
compute a kzalloc size and stored in rxtid->hold_q_sz, leading to
zero-size or overflowed allocations and subsequent out-of-bounds access.

Clean up any previously active aggregation session for the TID first,
then return early when win_sz is out of the valid range, instead of
proceeding with a broken allocation size.

Fixes: bdcd81707973 ("Add ath6kl cleaned up driver")
Cc: stable@vger.kernel.org
Suggested-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---

Changes in v4:
  - Move aggregation session cleanup before the window size check so
    that a previously active session is always torn down, even when the
    firmware sends an ADDBA event with an out-of-range window size
    (Vasanthakumar Thiagarajan).

Changes in v3:
  - Regenerated from wireless-next with proper git format-patch to
    produce valid index hashes (v2 had post-processed index lines).

Changes in v2:
  - No code changes from v1.

 drivers/net/wireless/ath/ath6kl/txrx.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/net/wireless/ath/ath6kl/txrx.c b/drivers/net/wireless/ath/ath6kl/txrx.c
index 80e66ac..a39c815 100644
--- a/drivers/net/wireless/ath/ath6kl/txrx.c
+++ b/drivers/net/wireless/ath/ath6kl/txrx.c
@@ -1722,13 +1722,15 @@ void aggr_recv_addba_req_evt(struct ath6kl_vif *vif, u8 tid_mux, u16 seq_no,
 
 	rxtid = &aggr_conn->rx_tid[tid];
 
-	if (win_sz < AGGR_WIN_SZ_MIN || win_sz > AGGR_WIN_SZ_MAX)
-		ath6kl_dbg(ATH6KL_DBG_WLAN_RX, "%s: win_sz %d, tid %d\n",
-			   __func__, win_sz, tid);
-
 	if (rxtid->aggr)
 		aggr_delete_tid_state(aggr_conn, tid);
 
+	if (win_sz < AGGR_WIN_SZ_MIN || win_sz > AGGR_WIN_SZ_MAX) {
+		ath6kl_dbg(ATH6KL_DBG_WLAN_RX, "%s: win_sz %d, tid %d\n",
+			   __func__, win_sz, tid);
+		return;
+	}
+
 	rxtid->seq_next = seq_no;
 	hold_q_size = TID_WINDOW_SZ(win_sz) * sizeof(struct skb_hold_q);
 	rxtid->hold_q = kzalloc(hold_q_size, GFP_KERNEL);
-- 
2.47.3

Re: [PATCH v4] wifi: ath6kl: fix OOB access from firmware ADDBA window size

[Vasanthakumar Thiagarajan]

On 6/26/2026 5:34 AM, Tristan Madani wrote:
> aggr_recv_addba_req_evt() logs a debug message when the firmware-supplied
> win_sz is outside [AGGR_WIN_SZ_MIN, AGGR_WIN_SZ_MAX] but does not
> return. The out-of-range win_sz is then used in TID_WINDOW_SZ() to
> compute a kzalloc size and stored in rxtid->hold_q_sz, leading to
> zero-size or overflowed allocations and subsequent out-of-bounds access.
> 
> Clean up any previously active aggregation session for the TID first,
> then return early when win_sz is out of the valid range, instead of
> proceeding with a broken allocation size.
> 
> Fixes: bdcd81707973 ("Add ath6kl cleaned up driver")
> Cc: stable@vger.kernel.org
> Suggested-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>

You can remove my suggested-by as I only provided review comments on your patch.

> Signed-off-by: Tristan Madani <tristan@talencesecurity.com>

With the above comment addressed,

Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>

Re: [PATCH v4] wifi: ath6kl: fix OOB access from firmware ADDBA window size

[Jeff Johnson]

On 6/28/2026 9:57 PM, Vasanthakumar Thiagarajan wrote:
> 
> 
> On 6/26/2026 5:34 AM, Tristan Madani wrote:
>> aggr_recv_addba_req_evt() logs a debug message when the firmware-supplied
>> win_sz is outside [AGGR_WIN_SZ_MIN, AGGR_WIN_SZ_MAX] but does not
>> return. The out-of-range win_sz is then used in TID_WINDOW_SZ() to
>> compute a kzalloc size and stored in rxtid->hold_q_sz, leading to
>> zero-size or overflowed allocations and subsequent out-of-bounds access.
>>
>> Clean up any previously active aggregation session for the TID first,
>> then return early when win_sz is out of the valid range, instead of
>> proceeding with a broken allocation size.
>>
>> Fixes: bdcd81707973 ("Add ath6kl cleaned up driver")
>> Cc: stable@vger.kernel.org
>> Suggested-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
> 
> You can remove my suggested-by as I only provided review comments on your patch.
> 
>> Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
> 
> With the above comment addressed,
> 
> Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>

Can you repost a v5. I can't take this one since:

WARNING:FROM_SIGN_OFF_MISMATCH: From:/Signed-off-by: email address mismatch:
'From: Tristan Madani <tristmd@gmail.com>' != 'Signed-off-by: Tristan Madani
<tristan@talencesecurity.com>'

You missed adding the From: tag in v4